Topic starter
14/09/2026 10:09 am
TL;DR: Role changes, contractor churn, and cross-system access combinations make manufacturing access reviews harder to judge, OpenIAM says. Spreadsheets leave reviewers without the lifecycle and conflict evidence needed to confirm removals and exceptions.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “Why Spreadsheet Access Reviews Fail Manufacturing Teams”.
Key questions
Q: Why do spreadsheet access reviews create compliance risk even when managers sign them?
A: Because a signature only proves that a list was checked.
Q: How should manufacturing teams know whether access review controls are working?
A: Look for a review process that exposes conflict context, reacts to lifecycle events, and produces timestamped revocation evidence.
Q: What breaks when access reviews are run as spreadsheets in manufacturing?
A: The review loses the identity context needed to make a meaningful decision.
Practitioner guidance
- Replace spreadsheet reviews with governed review workflows Present entitlement data with business context, SoD conflict indicators, lifecycle state, and an auditable decision trail so reviewers can assess actual risk rather than role labels.
- Trigger reviews from lifecycle events Fire review campaigns from plant transfers, role changes, terminations, and contractor expirations so access is reassessed when risk changes, not only on a fixed schedule.
- Map role combinations before review distribution Identify access combinations across SAP, directory services, and plant applications that create SoD conflicts, then surface those conflicts to reviewers before approval.
Bottom line: Spreadsheet access reviews fail because they strip out the identity context that makes access decisions meaningful.
Glossary terms: Access Review, Segregation of Duties, Lifecycle Trigger, Remediation evidence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 week ago by NHI Mgmt Group
14/09/2026 10:10 am
Spreadsheet access reviews create an evidence illusion, not an access governance control. The core failure is that the artefact records a review event while stripping away the context that determines whether the decision was valid. In manufacturing, that context includes SoD conflicts, plant transfers, contractor expiry, and privilege elevation across systems. Practitioners should treat the spreadsheet as an administrative extract, not as a governance mechanism.
A few things that frame the scale:
- 61% of organisations still define privileged users as humans only, overlooking the role of non-human identities in privileged access, according to KPMG.
A question worth separating out:
Q: What is the difference between a reviewed spreadsheet and a governed access review?
A: A reviewed spreadsheet is a static artefact that shows a list was circulated and marked up. A governed access review presents the full user profile, captures risk-informed decisions in workflow, ties revocations to completion, and retains exportable evidence for audit and remediation.
👉 Read our full editorial: Spreadsheet access reviews fail when identity context is stripped